Last updated: 2025-10-01
Controller: GradeBuilder SL
Registered address: C. Coronel Ivorra Ruiz 7, 1, 30720 San Javier, Murcia, Spain
Privacy contact: snatalya502@gmail.com
- Purpose and scope
This policy explains how GradeBuilder SL collects, uses, stores and shares personal data when you use our website and services. It applies to website visitors and persons who contact us via the site. - Personal data we collect
We collect only the data necessary to provide the service or answer inquiries:
• Name and email.
• Telephone number (if provided).
• Company and job title (if provided).
• Payment-related data processed by payment providers (Stripe, PayPal): we do not store full card numbers on our servers; we may retain transaction identifiers and billing information from the provider.
• Technical data collected automatically: IP address, browser user-agent, device information, pages visited and session logs.
• Cookies and analytics identifiers (Google Analytics, Google Tag Manager, Facebook Pixel, Hotjar) as described below.
We do not collect special-category (sensitive) data. - Legal basis for processing
• Contact form and direct enquiries: processed on the basis of GradeBuilder’s legitimate interest to respond to requests and provide services.
• Payments and contractual obligations: processed for the performance of a contract when you purchase services.
• Cookies and non-essential tracking: processed on consent when required by law. We will not send marketing emails unless you explicitly opt in. - Purposes of processing
We use personal data to: answer enquiries; provide services and handle transactions; process payments via Stripe or PayPal; host webinars/meetings (Zoom, Google Meet); administer the website; perform analytics to improve services; detect and prevent fraud; comply with legal and tax obligations. - Recipients and processors
We share data only with service providers acting as processors under contract and only to the extent needed:
• Stripe, PayPal — payment processing.
• Google Analytics, Google Tag Manager — website analytics.
• Facebook / Meta (Pixel) — optional advertising/measurement.
• Hotjar — behaviour analytics (if enabled).
• Zoom, Google Meet — webinar/meeting hosting.
• Hosting, email and infrastructure providers, accountants and legal advisers when required.
Some processors may transfer data outside the EU/EEA (for example Stripe, PayPal, Google, Zoom). Where transfers occur we rely on appropriate safeguards (EU adequacy decisions or Standard Contractual Clauses). - Cookies and tracking
We use essential cookies required for site operation. Non-essential analytics and tracking (Google Analytics, Hotjar, Facebook Pixel) are used only with consent where legally required. You can manage cookie preferences via the cookie banner or your browser. - Data retention periods
• Contact form enquiries and related correspondence: 3 years after last contact.
• Customer records, contracts and invoices (accounting): 7 years.
• Transaction identifiers and payment receipts: 7 years.
• Technical logs and security logs: up to 12 months.
• Aggregated analytics data: up to 26 months (standard Google Analytics retention).
If you request erasure we will delete your personal data unless retention is required by law. - Security measures
We use HTTPS, access controls, secure hosting and standard organisational measures to protect personal data. Processors are contractually required to apply appropriate security measures. - Contact form: processing basis and required logs (proof of lawful processing)
Contact form submissions are processed under legitimate interest to reply and provide requested services. For each submission we record and store: submitted form fields (name, email, message, phone/company if given), timestamp (ISO format), sender IP address, user-agent string, and the version/date of the Privacy Policy in force at time of submission. Stored example fields: name, email, message, submitted_at, ip, user_agent, privacy_version. These records are retained according to the retention periods above. - Marketing and newsletters
We do not send marketing emails by default. Marketing communications are sent only after an explicit opt-in. You may withdraw consent or unsubscribe at any time. - Your rights
You have the right to: access, correct, erase, restrict processing, receive your data in a portable format and object to processing under applicable law. To exercise rights, email snatalya502@gmail.com. We respond within statutory timeframes. You may also lodge a complaint with the Spanish Data Protection Authority (AEPD). - Children
Our services are not directed to children under 16. We do not knowingly collect data from children under 16. - Changes to this policy
We will post an updated policy at /privacy and update the “Last updated” date. Material changes will be communicated appropriately. - Contact details
GradeBuilder SL
C. Coronel Ivorra Ruiz 7, 1, 30720 San Javier, Murcia, Spain
Privacy contact: snatalya502@gmail.com